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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Not at all appropriate 
Not really appropriate 
Quite appropriate 
Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


In terms of deciding the various age brackets, both the development of 
children’s literacy skills, and their capabilities and knowledge of the online 
world through their education are important. The Commissioner should 
also take into consideration the report of the Byron Review, Safer 
Children in a Digital World 
https://www.iwf.org.uk/sites/default/files/inline- 


files/Safer%20Children%20in%20a%20Digital%20World%20report.pdf, 


V1.0 20180626 


which examines “whether the mechanisms by which children learn 
through ‘virtual’ worlds could be the same as those through which 
children learn in life” and looks at development stages, risk management 
and specific developmental age bands in the context of young people’s 
use of online services: “Given what we know about children’s brain and 
functional development, we need to offer support to their under- 
developed abilities (critical evaluation, lack of inhibition, ability to judge 
sources of information and make socially acceptable decisions). This 
support needs to change as children’s abilities develop”. 


Recent research by the National Literacy Trust found that there is a 
“dangerous lack in the literacy skills that children and young people 
require to navigate our digital world”. 
https://literacytrust.org.uk/research-services/research-reports/fake- 
news-and-critical-literacy-final-report/ 

Basing the age brackets in literacy and critical literacy development would 
mean considering the ages at which children and young people might be 
considered to become readers, independent readers, and critical readers, 
and how these skills and capabilities change as they grow up. 


To inform this decision, UK Safer Internet Centre recommends that the 
Commissioner makes use of a recent publication by the UK Council for 
Child Internet Safety (UKCCIS) called Education for a Connected World 
https://assets. publishing.service.gov.uk/government/uploads/system/upl 
oads/attachment_ data/file/683895/Education for a connected world PD 
F.PDF , launched by the DCMS in 2018. It is a comprehensive framework 
for online education that details the skills, competences and knowledge 
that children should develop at each age group as follows: under 7, 7-11, 
11-14 and 14-18. Education for a Connected World uses age groups that 
roughly mirror Key Stages in the curricula for schools in England, Wales 
and Northern Ireland and is similar to the age breakdowns used in the 
education system in Scotland. 


For instance, by the age of 11 should be able to “create and use strong 
and secure passwords” and “explain how many free apps or services may 
read and share my private information (e.g. friends, contacts, likes, 
images, videos, voice, messages, geolocation) with others.” By the age of 
14, the framework indicates that young people should be able to “make 
informed choices” about app permissions and common online services’ 
terms and conditions. By the age of 18, young people’s knowledge and 
understanding progresses and they would be expected to be able to 
“describe key aspects of the law governing data use (e.g. DPA, GDPR) 
and, from my own media research, [giving] examples of those laws and 
their impact”. 


The framework is not a statutory part of the curriculum in any part of the 
UK; it expands upon and draws from the elements of the curriculum that 
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focus on teaching and learning how to use technology safely and 
respectfully. It does not represent the current knowledge, understanding 
and experience of children and young people today, but “describes the 
Digital knowledge and skills that children and young people should have 
the opportunity to develop at different ages and stages of their lives. It 
highlights what a child should know in terms of current online technology, 
its influence on behaviour and development, and what skills they need to 
be able to navigate it”. Nevertheless it provides a sound starting point for 
delineating the points at which most young people may have reached 
certain developmental milestones as regards their online education and 
experience. 


It should be noted that for children and young people with Special 
Educational Needs and Disabilities (SEND) other legislation considers that 
they are considered young people until the age of 25, with development 
milestones reached at a different pace and age. The Commissioner should 
take the needs of all children into account when deciding on the age 
brackets to make them meaningful. 


UK Safer Internet Centre also suggests that the emphasis for the digital 
resilience of 0-2 year olds should be focused on parental support and 
worth noting that the IWF concluded that this age group, according to 
their annual report, suffer the most severe forms of abuse. 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 


10-12 year olds 

It is worth noting that the UK Safer Internet Centre sees much variation 
in technology use for the 10-12 year old bracket given the transition from 
primary to secondary schooling - the standards for a 10 year old will vary 
significantly to that of a 12 year old 


The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


UK Safer Internet Centre welcomes the inclusion of the UNCRC within the 
code, particularly with reference to the treatment of anyone under the 


V1.0 20180626 


age of 18 as a child (Article 1) and therefore to be included in this 
legislation. Along with Article 1, Articles 2-4 should underpin the Code - 
including the right to non-discrimination, respect for the views of the 
child, and the protection of rights. Article 12 is also key - it is crucial that 
the best interests of the child are paramount in relation to data 
protection. 


UK Safer Internet Centre considers the following Articles also have 
particular relevance for the Commissioner in designing the Code: 


Articles 4/5 - concern the responsibility of Government to uphold 
children’s rights and to create an environment in which parents can fulfil 
their role as nurturers of children. The Code represents an opportunity to 
require online services to take steps to ensure that the environment in 
which they operate informs parents about how their services operate in 
relation to data and privacy, using channels and methods that they can 
reasonably be expected to access and understand, so that parents can 
make informed decisions about their children’s use of online services 
according to their evolving capacities. 


Article 13 - considers freedom of expression and the child’s right to get 
and share information, “as long as the information is not damaging to 
them or others”. While this Article also refers to the responsibility that 
children have to respect the rights, freedoms and reputations of others, it 
does not detract from their right to receive and share information in the 
ways they choose. The Code will need to take this into account to make 
sure that children can exercise their full right to access information online, 
while upholding the limits of the Article, that states that children should 
be protected from accessing and sharing information online that is 
damaging to them or others. 


Article 16 - states that children have a right to privacy and that the law 
should protect children from attacks against their reputation and way of 
life as part of their right to privacy. The Code as it is developed should 
require online services to put in place procedures, content, partnerships, 
tools and support for young people that enable and empower them to 
look after their own privacy and respect others’ privacy. It should also 
require that online services put in place sufficient mechanisms to quickly, 
efficiently and transparently respond where this does happen in order to 
provide children and young people with adequate redress and confidence 
in continuing to use online services. Providing all children and young 
people - as a vulnerable group - with the reassurance that content can 
be removed where that contravenes their right to be protected from 
attacks against their privacy under the UNCRC, adheres to one of the core 
principles of the UNCRC, that of respecting the views of the child. 
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Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e the presentation and language of terms and conditions and privacy 
notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user engagement, 

e user reporting and resolution processes and systems, 

e the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 

e the ability to access advice from independent, specialist advocates 
on all data rights, and 

«e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


UK Safer Internet Centre welcomes the establishment of a shared 
taxonomy as regards the Code, and provides some thoughts on 
particularly terminology to be used in developing the Code. 


Design 

Design with regard to data processing in online services should include 
not only function, but also form of online services. The development of 
the Code should take into account not only what online services do, as 
regards processing of personal data of children and young people, but 
also how they look and what they communicate, and how words, imagery, 
design constructs and functions operate together and are used to 
persuade individuals to disclose personal information. Good practice 
should be that information is presented clearly, prominently, in an age- 
appropriate way, ensuring that the user understands the online 
environment in which they are present, and whether what they contribute 
to it is private or public, for instance. 


Data processing 
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Processing means any operations regarding how data is gathered, 
arranged, stored, shared or destroyed. 


Services ‘likely to be accessed by children’ 

This means that the Code needs to apply to any online service that is 
aimed at or likely to be accessed by under 18s, whether or not it is 
specifically designed to appeal to them. 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


UK Safer Internet Centre welcomes the inclusion of all the aspects of 
design proposed by the government which the Commissioner should take 
into account when developing the Code. Below we provide some thoughts 
on some of the areas. 


Default privacy settings 


Safety by design, privacy by design and privacy by default should be the 
guiding principles for all products and services/ features and 
functionalities addressed to, or used by, children. 


The Code must offer a high bar of data privacy by default, rather than as 
an option that users must engage with and set themselves. This would 
help protect children’s privacy as a norm on all online services that they 
are likely to access, and allow them to give meaningful consent to data 
processing at an age or stage when they can be considered able to do 
this. The process of engaging with and giving meaningful consent would 
be a ‘teachable moment’ for young people, ensuring they have good 
understanding of their rights, obligations and the responsibilities of online 
services. 


Criteria, rating and labelling of data privacy should as far as possible be 
standardised across different services, meaning there would be clarity 
about what the privacy offer is. This would provide an important 
advantage to young people in increasing their understanding of data 
privacy; they access a huge range of types of services and these change 
regularly as they grow up. 


Children must have the ability to change settings, as well as the 
information presented to them in an age appropriate way to understand 
the impact of any decisions they make and to make informed decisions. 
Good practice should include regular reminders for children about the 
decisions that they have taken, and prompts to review their decisions as 
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they grow up. Adults should also be reminded regularly to review privacy 
settings on their devices and services, since in many families, adult- 
owned devices are regularly accessed by children. 


Privacy settings should not be used to unnecessarily restrict or block 
children from online services, as this could impact on their right to get 
and share information (Articles 13 and 17 of the UNCRC) as well as their 
freedom of association (Article 14). 


Data minimisation standards 


Children and young people do not have a full understanding of the extent 
to which their personal data is collected, used or shared by online services 
they use. This contravenes their rights as children. Data processing must 
be determined by, and aligned to, a child’s exact use of a service, and 
only during the time they are actively using a service. Young people 
surveyed by Childnet have different ideas about the amount and nature of 
data different online services really need in order to make them work 
properly — citing “none other than date of birth”, “age, location, interests” 
and “mobile number, email and name, and often age”, they typically cite 
a much larger range of their data that companies hold - “History, amount 
of usage, searches, contacts, age, affiliations, name ...” (young people 
aged 13-17). 


Specific and age-appropriate methods and language must be used in 
communicating to young people about the reasons for data collection, so 
that young people can, where required, give meaningful consent. This 
also means that data minimisation must be by design and not require 
additional user management. 


The language and presentation of terms and conditions and 
privacy notices 


Very few young people or adults attempt to read these before agreeing to 
them and the lack of clarity impacts negatively on young people’s 
understanding and trust around handing over their data; one person 
surveyed said that online services need to, “be clear. These days, 
companies have everything, and it can be easily leaked or sold for profit 
like the Cambridge Analytica scandal.” The Code must require online 
services likely to be accessed by young people to present notices in age 
appropriate ways that children can understand, to enable them to make 
informed decisions about whether to consent or not. While setting a 
reading age appropriate to the youngest users of an online service goes 
some way to address this, Childnet, in its work with young people, 
frequently hears them ask for presentation of Ts&Cs and privacy notices 
that young people can reasonably engage with given their developmental 
level, don’t take long to engage with and are clear. 


V1.0 20180626 


Young people surveyed by Childnet suggest online services “make a short 
video on it before you agree to it”, and that online services should 
“Properly explain rather than stating the law”. Properly explaining would 
prohibit catch-all phrases such as the gathering of personal data to 
“provide, troubleshoot and improve services” that provide a legal starting 
point for the justification of gathering and processing non-essential data. 


Over recent years there has been work to better illustrate and articulate 
the details contained within terms and conditions and highlight the use of 
‘labels’. We are all familiar with nutritional labelling on food, laundry 
labelling on clothes and eco labels describing energy ratings on items, but 
terms and conditions and privacy statements remain resolutely 
inaccessible, especially for children. Labelling will enable users to 
understand, at a glance, aspects of the terms and conditions, in particular 
what data is collected and how it is used. UK Safer Internet Centre has an 
active project to utilise labelling technologies and recommends that 
labelling for terms and conditions is considered 


Moreover, where a significant number of young people younger than the 
legal age limit for an online service are nevertheless using it, information 
must be presented to the audience in an age-appropriate way that 
recognises this. 


Additionally UK Safer Internet Centre suggests that terms and conditions 
should be drafted with the minimum age of users in mind. For example 
services which are designed and accessible for anyone over 13, should be 
accessible to a 13 year old and measured using reading indices (eg 


http://gunning-fog-index.com/). 


Currently providers are required to record that users ‘accept’ the terms, 
but would suggest that acceptance is only possible if users ‘understand’. 
Providers should therefore evidence that users both understand and 
accept. 


Providers should be required to notify users of changes to the terms and 
conditions or privacy statements 


In order to compel online services to present this information in such a 
way as to ensure the young people using them can understand what they 
are agreeing to, the Commissioner should use the Code to specify that 
failure to do this will result in a breach of the Code, ensuring that online 
services have to address this. 


Uses of geolocation technology 
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Unless a geolocation is critical to an online service working properly for a 
young person, it should be off by default, and where it is used, it should 
expire aS soon as a young person stops using a service, at the first 
opportunity. Online services must be required to carry out risk 
assessments for geolocation services in products that are likely to be 
accessed by under 18s. 


When a child’s location is being tracked, it should be obvious to the child, 
through on-screen symbols or colours, and they should be told if their 
location is being shared with another person or user. 


Geolocation should, as a principle, be used by young people to enhance 
an online service rather than to access it. Children and young people 
should not be excluded from using an online service if they choose not to 
share their location. Code of practice for the provision of location services 
(on mobiles) , 2004 


Automated and semi-automated profiling 


Childnet asked young people aged 13-17 what they thought about online 
services using information about them to show them things that might be 
interesting. Their experiences are not particularly positive - one 
respondent said “Their algorithms ... often don't actually show you things 
you'd be interested in but instead show you advertised videos that they'd 
make money from.” Most said that the sites rarely or never show them 
things that are relevant. 


In the discussion around profiling, there is the potential for positive use, 
in that knowing the age of a child can ensure defaults on safety settings 
are implemented correctly, and prevent inappropriate advertising. 


Transparency of paid-for activity such as product placement and 
marketing 


This must always be clear, prominent and transparent to the user. 
Advertising should be sufficiently prominent to identify the marketer and 
commercial intent. Since children and young people are vulnerable to the 
pressure of advertising, the characteristics and quantity of paid-for 
content should be aligned to a child’s development needs. Children should 
learn about advertising, how it works and the commercial intent of 
marketing communications in school, as part of PSHE and literacy. 


User reporting and resolution processes and systems 
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Children and young people under-report, and face barriers in reporting, 
especially where the nature of the report concerns personal data or 
information, or where the data is inaccurate, defamatory or illegal. 
Childnet’s own research with 13-17 year olds found that nearly 40% of 
young people tend to ignore it when they experience online sexual 
harassment, rather than report it, because of embarrassment, a concern 
about the consequences of reporting, or a belief that nothing would 
happen as a result. In fact, nearly half (43%) said “I don’t think it would 
help”, and similar number said they wouldn’t bother reporting because 
they would be worried about what would happen next. 


The Code represents an opportunity to require online services to 
communicate better and in an age-appropriate way with young people so 
they can understand how to report, what happens if they do, and ensure 
that where young people do report, their privacy is protected. Online 
services should also be required to respond to reports, according to 
universal reporting standards that include indicative timescales that can 
make a real difference to young people’s experiences of abuse of their 
privacy and data; this is a key area where young people’s frustration with 
online services is clear. According to Childnet’s research as part of our 
deSHAME project https://www.childnet.com/our-projects/project- 
deshame, one 13-year-old said “I’ve tried reporting stuff before but it’s a 
long process cause like say Instagram or Snapchat you'd get a reply 
maybe after a week, a month or something. By the time it finishes then 
something else could have happened”. 


The reporting process requires transparency for young people, as well as 
feedback for users as to the outcome of a report and advice as to what to 
do next. 


UK Safer Internet Centre has just released a national ‘Reporting Harmful 
Content’ hub that accepts complaints from users aged 13 and over who, 
having reported content to an ISS, the complainant considers the provider 
to have taken no or insufficient action. The hub will consider the 
complaint and provide a more in-depth response and/or work with the 
ISS to remove the content 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Uses of geolocation technology 
Geolocation should, as a principle, be used by young people to enhance 


an online service rather than to access it. Children and young people 
should not be excluded from using an online service if they choose not to 
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share their location. UK Safer Internet Centre recommends that the 
Commissioner have reference to the recommendations in this Code of 
practice, for the provision of location services from 2004, as a guide when 
developing the Code. 


The strategies used to encourage extended user engagement 


Many children and young people are aware of the impacts of spending a 
lot of time online, and of techniques that can be used to set limits 
themselves and take responsibility. The Code should recognise that 
compulsive use of technology is high risk and can contribute towards 
physical and mental ill health, and should ensure work to ensure policy 
coherence in development of public policy across government. 


In preparation for this submission Childnet surveyed the views of our 
Youth Board. While some individuals feel they “always” spend more time 
than they'd like to using online services, they suggest things like, “get an 
app that tracks how much time you spend on your phone, turn it off and 
go out without it” to counteract their excessive engagement. 


However, it should not be up to children to take sole responsibility for 
their engagement with online services. Online services need to do more to 
make it easier for young people to switch off, including: 
e anopt-in to the auto-play feature on video streaming, with the default as off for 
under 18s 
e a notification telling young people “you’ve caught up now” as they scroll through 
updates, for instance already used by Instagram 
e upon signing up for an online service, all notifications, buzzes read receipts and 
other alerts designed to increase user engagement should be switched to off as 
default with regular opportunities to review notification settings and clear 
language to explain the impact of changing a setting 
e regular reminders of time spent on an online services 


While young people can be supported with strategies to help them 
monitor their use of online services, parents also have a role to play in 
this. In our work, UK Safer Internet Centre regularly supports parents 
through workshops, and Childnet has developed a ‘family agreement’ 
which parents and children can use together to agree limits on screen 
time and how children access online services. 


Schools 

SWGfL created and released an online safety self review mechanism - 360 
degree safe in 2009 and currently used by over 12,500 schools. The 
system enables schools to rate their provision against a set of 28 different 
aspects to determine their performance and create a development plan. 
This rating data discloses the relative performance of all schools and is 
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captured in an annual ‘state of the nation’ assessment report 


(www.swodfl.org.uk/report2017). 


Data Protection is one of the 28 aspects and is in context of the “ability of 
the school to be compliant with the current Data Protection Act and 
Freedom of Information legislation (which includes the General Data 
Protection Regulation compliance). It describes the ability of the school to 
effectively control practice through the implementation of policy, 
procedure and education of all users”. In 2017 we concluded that the 
relative performance of data protection was weak in comparison with the 
other 27 aspects - it ranked as 22 out of 28. The data suggests that 
33.371% of schools have no data protection policy (either no policy or 
policy is in development). There is further data and evidence within the 
dataset and report relating to schools management of data and 
information. 


As a further effort to support schools with their data protection processes, 
a data protection self-review tool, 360data was launched in June 2016. 
360data is based on the same mechanism as 360dgree safe but provides 
16 aspects for self-review alongside policy templates. The online self 
review application supports and challenges schools in assessing and rating 
their current data and information security provision. Whilst the numbers 
of participating schools are not statistically representative, the aggregated 
rating data suggests that weaknesses include Data Protection Impact 
Assessments as well as how Governors are involved and the Third party 
arrangements that schools have. 


It is clear from this evidence that schools require significant help and 
support and would welcome ICO engagement in supporting both SWGfL 
and UK Safer Internet Centre in addressing this issue. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


Social Media Provider Guidelines 

The UK Council for Internet Safety (UKCIS) produced a set of guidance for 
social media platforms. UK Safer Internet Centre recommends that the 
Commissioner use this and take it into account when developing the 
Code, especially the recommendations and guidance around privacy. 


Q5D. examples of ISS design you consider to be good practice. 
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Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Name 
Email 
Brief summary of what you think you could offer 


UK Safer Internet Centre 

We are a partnership of three leading organisations: Childnet 
International, Internet Watch Foundation and SWGfL, with one mission - 
to promote the safe and responsible use of technology for young people. 


What we do: 


The partnership was appointed by the European Commission as the Safer 
Internet Centre for the UK in January 2011 and is one of the 31 Safer 
Internet Centres of the Insafe network. The centre has four main 
functions: 


1. Awareness Centre: to provide advice and support to children 
and young people, parents and carers, schools and the children's 
workforce and to coordinate Safer Internet Day across UK. 

2. Youth: to provide opportunities for the views, perceptions and 
experiences of youth to be hear 

3. Helpline: to provide support to professionals working with 
children and young people with online safety issues. 

4. Hotline: an anonymous and safe place to report and remove child 
sexual abuse imagery and videos, wherever they are found in the 
world. 


The UK Safer Internet Centre is funded under the Connecting Europe 
Facility (CEF) programme of the European Commission. As such we 
contribute to the Better Internet for Kids (BIK) core service platform to 
share resources, services and practices between the European Safer 
Internet Centres and advice and information about a better internet to the 
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general public. In line with the European Commission's Better Internet for 
Kids strategy, the key vision behind the BIK core service platform is to 
create a better internet for children and young people. 


UK Safer Internet Centre via the three partners have a strong national 
position with opportunities to support the ICO work both in terms of 
research and implementation 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 

UK Safer Internet Centre is a partnership of three leading 
charities and exist to promote the safe and responsible 
use of technology for young people 


A body representing the views or interests of parents? 
Please specify: 

UK Safer Internet Centre provides advice and support to 
parents 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 
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Thank you for responding to this call for evidence. 
We value your input. 
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